1. Who we are
Noteminator ("we", "us") is the operator of the Noteminator app and website at noteminator.com. For privacy questions, contact info@noteminator.com.
2. What we collect
Account data. Email address, display name, profile photo (only if you sign in with Google), and a hash of your password. Your Google identifier is stored for sign-in continuity.
Note content. Titles, body, keywords, and any attachments you create. Note content is end-to-end encrypted with AES-256-GCM envelope encryption; only ciphertext is stored at rest.
Service data. IP address, browser, operating system, device type, language, page paths, referrer, and timestamps. Used for security, abuse prevention, and aggregate analytics.
Billing data. Receipt identifiers from the Google Play, App Store, or Microsoft Store. We do not store full payment card numbers — those are handled by the platform processors.
3. How we use it
To run the service (authentication, sync, billing), to maintain security (detect and block abuse), to communicate about your account, and to improve the product through privacy-preserving aggregate analytics.
We do not sell or rent your data. We do not use your note content for advertising or model training.
4. Legal bases
Contract performance (running the app you signed up for); legitimate interest (security and fraud prevention); consent (marketing emails — only with opt-in); and legal obligation (tax, anti-fraud, and lawful disclosure requests).
5. Sharing
We share data only with: cloud infrastructure providers (under data-processing agreements), payment processors (the app store you used), and authorities when compelled by lawful request. We do not share data with advertisers or brokers.
6. Encryption and access
Note content is encrypted under three keys (root → user → note). Only ciphertext is stored at rest. Developer access to plaintext requires an audited multi-step operator action and is performed only in response to lawful requests.
7. Retention
Account data: until you delete your account. Note content: until you delete the note (90 days in trash, then permanently). Login attempt logs: 12 months. Visitor logs: 24 months. Backups: rolling 30-day window.
8. Your rights
You may access, correct, export, or delete your data at any time. To delete everything, use Dashboard → Delete account, or email info@noteminator.com. We respond within 30 days.
9. Children
The service is not directed to children under 13 (or under 16 where applicable). We do not knowingly collect data from children.
10. International transfers
Noteminator servers are located in Türkiye. If you access the service from outside Türkiye, your data is transferred to and processed in Türkiye under standard contractual clauses where required.
11. Changes
Material changes will be announced in-app at least 30 days before they take effect. The current version of this policy is always available at noteminator.com/legal/privacy.
12. Contact
info@noteminator.com · Noteminator Operasyon, İstanbul, Türkiye.